Built for Lists, Not One-Offs
Checking certificates one domain at a time is fine for a single site. It falls apart when you look after a client list, a company with dozens of subdomains, or every hostname in a Cloudflare account. Paste them all here and the table comes back sorted with the problems on top.
- Expiry date and days left for every certificate
- Trust. Self-signed, expired chain, or unknown authority
- Hostname match. Does the certificate actually cover that name, with wildcards matched the way browsers do
- Behind a CDN. Flags hostnames where you're seeing Cloudflare's edge certificate, not your server's
- Export. Download the table as CSV for a client report or a ticket
How to Read the Table
Automated certificates renew around 30 days before expiry, so anything amber or worse usually means renewal is failing, not just that renewal is coming up.
From a Snapshot to a Warning
A bulk check tells you about today. Certificates now last at most 200 days, heading to 47 by 2029, and Let's Encrypt no longer emails expiry reminders, so today's green table can be tomorrow's outage. Monitor all adds every domain from your results to DomainCat in one step, and you get an email at 30, 14 and 7 days before any of them expire. For a CI pipeline, the free GitHub Action does the same check on a schedule.
Bulk SSL Checker FAQ
How many domains can I check at once?
Up to 25 per run, a few runs per minute. To watch more than that continuously, add them to DomainCat: the free plan covers 5 domains, Pro covers 50 and MSP is unlimited.
What does the bulk SSL checker check?
For each domain it connects on port 443 and reads the certificate the server presents: expiry date and days left, the issuer, whether the certificate is trusted by public certificate authorities, and whether it covers that exact hostname.
Why does a domain behind Cloudflare show a healthy certificate?
Because the checker reaches Cloudflare, not your server, so it reads Cloudflare's edge certificate, which Cloudflare renews automatically. The certificate on your origin server can still expire and cause Error 526. Use the origin certificate checker or DomainCat's origin monitoring for that.
Can I export the results?
Yes. After a check, use Download CSV to save the table, or Monitor all to add every domain to DomainCat and get emailed at 30, 14 and 7 days before each certificate expires.
Is there a command-line or CI version?
Yes. The free SSL Certificate Expiry Check GitHub Action (740ft/ssl-expiry-check) runs the same kind of check in a scheduled workflow and fails the run before a certificate expires.